feat(fusion_helpdesk): customer follow-up + embedded ticket inbox

Squash-merge of feat/helpdesk-customer-followup. The billing and
fusion_login_audit work from that branch is already on main (landed
separately); this lands only the helpdesk feature.

- Identity keystone: submit() forwards partner_email/partner_name/
  x_fc_client_label so the central Helpdesk find-or-creates the customer
  partner and subscribes them as a follower (enables reply emails + magic link).
- Embedded in-app 'My Tickets' inbox: server-side scoped read/reply RPC
  endpoints, per-user seen tracking (fusion.helpdesk.ticket.seen), systray
  unread badge. Defense-in-depth scope domain + _norm_email normalisation
  (wildcard emails cannot widen scope).
- fusion_helpdesk_central: x_fc_client_label field + list/search views +
  branded acknowledgement email template.
- Deployed and smoke-tested live: nexa central 19.0.1.1.0, entech client
  19.0.1.4.1 (requires Contact Creation on the central service account).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fusion_helpdesk/__manifest__.py

@@ -3,7 +3,7 @@
 # License OPL-1 (Odoo Proprietary License v1.0)
 {
     'name': 'Fusion Helpdesk Reporter',
-    'version': '19.0.1.3.0',
+    'version': '19.0.1.4.1',
     'category': 'Productivity',
     'summary': 'One-click in-app bug reporting & feature requesting — '
                'auto-creates a helpdesk.ticket on a central Odoo Helpdesk.',
@@ -27,6 +27,7 @@ module bundle. No dependencies on the rest of Fusion Plating.
     'license': 'OPL-1',
     'depends': ['base', 'web', 'mail'],
     'data': [
+        'security/fusion_helpdesk_groups.xml',
         'security/ir.model.access.csv',
         'data/ir_config_parameter_data.xml',
         'views/res_config_settings_views.xml',